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NATIONAL SECURITY AGENCY 
CENTRAL SECURITY SERVICE 

FORT GEORGE G. MEADE, MARYLAND 207SS-6000 


7 September 2010 


MEMORANDUM FOR THE CHAIRMAN, INTELLIGENCE OVERSIGHT BOARD 


THRU: Assistant to the Secretary of Defense (Intelligence Oversight) 

SUBJECT: (U/ /FOUO) Report to the Intelligence Oversight Board on NSA Activities - 
INFORMATION MEMORANDUM 

(U//FOUOT Except as previously reported to you or the President, or otherwise stated in 
the enclosure, we have no reason to believe that intelligence activities of the National Security 
Agency during the quarter ending 30 June 2010 were unlawful or contrary to Executive Order or 
Presidential Directive and thus should have been reported pursuant to Section 1.6(c) of Executive 
Order 12333, as amended. 


(U/ /FQUO) The Inspector General and the General Counsel continue to exercise oversight 
of Agency activities by inspections, surveys, training, review of directives and guidelines, and 
advice and counsel. These activities and other data requested by the Board or members of the staff 
of the Assistant to the Secretary of Defense (Intelligence Oversight) are described in the enclosure. 



^§e<S?i 

GEORGE ELLARD 
. IrfsBector General 




Matthew g. olsen 

General Counsel 


(U//POUO) I concur in the report of the Inspector General and the General Counsel and 
hereby make it our combined report. 



General, U. S. Army 
Director, NSA/Chief, CSS 


Enel: 

Quarterly Report 

Hits document may be declassified and marked 
“UNCLASSIFIED/ /For Official Use Qnlf' 
upon removal of enclosures} 
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1, (U) Intelligence, counterintelligence, and intelligence-related activities that 
violate law, regulation, or policy substantiated during the quarter, as well as 
actions taken as a result of the violations 


(U) Intelligence Activities 

(U //r0U0) Unintentional Collection Against U.S, Persons or Foreign Persons 
in the United States 

(S/'REL USA. I Vr Y> I his quarter there were ] [ instances in which Signals Intelligence 
(SIGINT) analysts inadvertently targeted or collected communications to. from, or about ITS 
persons while pursuing foreign intelligence tasking. All intercepts and reports have been deleted 
or destroyed as required by United States SIGINT Directiv e (USSID) SP0018. 


(b)(1) 

(b)(3)-P.L. 86-36 


a SIGINT analyst at a collection site discovered 


(U) Targeting 

t N .SI lil.l l OUSA, TYPY) 
that a tclcphtme selector for a l .S. person was inadv ertently targeted. The tasking error occurred 
because the an.ilyst 1 > ns pe. ed 1 v digits <>f the telephone number. The site deiasked the selector 
and deleted collection on No reporting was issued baseci on the collection. 

.b)(1) 

"Selectors had 


iS RH TO ITT rV I .Y) 


an NSA analyst found that 


r. n lined t. Ted while ta rgets were i n m l Unit ■ I St ties . Traffic collected 

was deleted 


were deiasked on| 


(b)(3)-P.L. 86-36 


from a different tasked selector for one of the 
deletion! 


The selectors associated with the targets 
lanothcr analyst found additional collection 


hargeis. I he collection was marked for 


no reports were issued. 


(b)(1) 

(b)(3)-50 USC 3024(i) 
(b)(3)-P.L. 86-36 


IS Mil KUNA. FVEYi 


MSA analysts learned a foreign intelligence t ar jet 
had arrived in the United States on These 

anal ysis neglected to share this informat ion with other NSA colleagues targeting this indh idnal 
until 


the second group of analy sts suspended associated 


collection and deiasked an e-mail selector. N , r< ports were issued. 


(S Rkl TO^SA.FVEY) 


(b)(1) 

(b)(3)-P.L. 86-36 


an N S A analyst queried a raw traffic database 


using an e-mail selector associated with a U.S. person, i he analyst conducted the appropriate 
research to determine the location of the newly identi fied selector: however, the analy st 
overlooked information t hat attributed the se lector to a U.S. person tasked under art FAA 704 

(Truncation that expired_pfie anal yst deleted th; quer y re suit the s ami day 

v ithoul view ing them. 1 he analyst deleted the querv l | 1 here w as n<> rep vrting. 


fhi ai ily st was counseled to conduct i toi; thorough research on the location of targets before 
querying. 


Derived I nan: \S \ '( SSM 1-52 
Dated: 2007010.8 
Declassify On: 20320108 

1 UP St t ill i mVIM No; URN 
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(B)(1)... 

(b)(3)-50 US.C 3024(i) 
(b)(3)-P.L. 86-36 


10P !U CRI 'T'TmilN IV/NOTORN 


(b)(1) 

(b)(3)-50 USC 3024(i) 
(li)(3)-18 USC 798 
(b)C3)-P.L. 86-36 


(S VRH1, TO USA, TVTY) During a rout ine audit, conducted] 
that an analyst had inadvertently queried 


NSA discove red 
in a 
the 


raw traffic database. The incident occurred because the analyst did not verity the status of 
entity before performing the query. All queries and results were deleted. 


■fS ^F/REL TO USA. hVliY) 


(b)(3)-P L 86-36 


(Bra . 

(b)(3)-P.L. 86-36 


an NSA analyst discovered that the selectors 
for a valid foreign i ntcl 11 gene e target were queried in a raw traffic database while the target was 
located in the l nited States onl 


& analy st deleted the query results 
implemented to ensure that traffic is reviewed 


New procedures have been 


(S//SI//REL 1 (> USA. i - 'VUY 


target had traveled to the United States from 


an NSA anah st learned that a valid foreign 


a 


•collection on| 
after returning from leave, the analyst 


detasked 

target selectors. 

'*3 

that had been collected while 

I he target w as in the United States. Database 


were also deleted) 

Intelligence Community customer and learned that the customer knew that the target had been in 


the United States from 
reminded to alert NSA when ta 


(ChRl - L TO USA. FVUY 


No reports were issued. The analyst contacted-the 
ned that the customer knew that the target ha 
Ibuineglected to tell NSA The customer was 


the United States: 


(b)(1) 

(b)(3)-P.L. 86-36 


vised in the United 


an NSA analyst queried on the selector used by 
Slates. The incident occurred because the analy st 

before performing the 


foreign intelligence target 
did not conduct sufficient rescan 
queries. The query and results were deleted) 

(U) Database Queries 

(( V/RBU to T.i>u-\. FVh Yy Of j j occasions, tn ilysts benstructcd database queries that targeted 
U.S. person and . | | ei those occasions, the queries returned results from tf database. The 
results returned from these overly broad or poorly co nstru cted queries were deleted, and no 
reports were issued. Procedural errors contributed t q| [ violations. 


(( • iil l i t) USA. 1 Ul'.Yl 


_an NSA analyst discovered that selectors 

tasked in a database were associat ?d v *ith c I ,S. person. I he terms were tasked by a 
previous analyst who believed that the selectors were associated with a valid foreign 
intelligen ce Tamer. The anal y st immediately submitted a request to have the selector 

detasked._|the selector was detasked. and the analyst deleted his query 

and the results. 


( TS//Si//ND 
database using 
to retrieve traffic containing threats pertaining to 

v 1 f 


a SIGINT analy st performed a query in a raw traffic 

as a query term, i ite ucrv w as dei- t iled 


The analvst was unaware ofl SMI) 


iOP M t Ri I i n , VlfN i. i m\Di URN 

? 
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(b)(1) 

(b)(.3)-P.L. 86-36 


SP0018 guidelines for performing this yp • of quety. The query was deleted 
2010 . 


fed) 

(b)(3)-P L. 86-36 


tv M Rri. in l s.\. rvi •) 1 


containing U.S. selectors. The queries returneef 


an NS A audi tor disem ered queries \ 
results: however, the 


application had difficult} loading the results. Therefore, no 1 '.S. co mmunication ■ \ c g 
reviewed and no reports were issued. The analyst deleted the results 


i w si r; i to usa. tvt Y> 


an NS A anah st queried a raw trafft 


database using an e-mail selector known to be associated with a U.S. person usually 
located in the l nited States, 1 he selector was found to be in contact with a \alid foreign 

kinder I 'AA 7u2 authority. The analyst queried the 


tasked 
selector 


2010. but did not conduct appropriate research 
before performing the query. After running the query 
told by other branch members that the e-mail add re > was used by a U.S. person. The 


the analy st was 


analyst deleted the query results or 


There was no reporting. The analyst 


was counseled ..by branch management on the importance of making appropriate 
determinations about locations of targets before querying. 


A Si .. PIT TO UDA.TVfdfo On 


against 


NS A analyst submitted one query 


Although the analyst's original target was a valid foreign 
mtUlmcncc target, the analyst expanded th e search to incluck the l. ,S. selector. Oi 
an NSA auditor discovered that 


and requested the analyst to do further research. 


after searching open 


source information, the analyst determined it to be a U.S. selector and deleted the query 
and results. No reporting was issued. 


(b)(1). 

(b)(3)-P.L. 86-36 


(b)(1) 

(b)(3)-P.L. 86-36 


(>fobb "RbT |QI w [ ■ ■ hY) | 

I I t .S. telep hone nunibers| 
all the selectorsf” 


an NSA analyst inadvertently queried 
The analyst neglected to ascertain whether 

l 


ta rgets , and not U.S. telephone numbers: therefore, the query inadvertently contained 
f J.S. telephone.numbers. Upon seeing the lar ge number of re sults returned, the 


analyst deleted the results without viewing them oq_| The analyst confirmed 

that no further collection had occurred, that all collection had been deleted, and that the 


Telephone numbers had been deleted from the query. 


~ti'- M Ni-t an 

vA t nalvst learned that a selector quo 

riy,d on 


was. associated 

with a 

J.S. 

person. NSA. received Attorney General, authorization tc 


i _ r 

outside the United States, i hese time period? 

included 



1 




the Nsb 

i ana 

lyst 

n v ul \'7i n 1 1.1 1 ilh f hi ‘ it i Ji tv, , mult tuff-. I ian 1 


fnr.. 1 hi\ ti muFr^tmu 







i » ' * v 1 l v l 1 m • 5.1. v 
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(B)(1) 

(b)(3)-P L. 86-36 


imr ::: 

(b)(3):*P.L. 86-36 


(B)(1):;:::. 

(b)(3)-50 :: USC 3024(i). 

(b)(3)-P.L. 86-36 : - 


(b)(3)-P.L. 86-36 


(b)(1) 

(b)(3)-50. USC 3Q24(i) 
(b)(3)-P.L. 86-36 


(b)(1) 

(b)(3)-P.L. 86-36 


TOP SLCllL I b COMINTY/NOi ORN 


(b)(1) 

(b)(3)-50 USC 3024(i) 
(b)(3)-P.L. 86-36 


was in error and notified branch management 


the NS A analyst deleted the query and the returned results. There was no reporting. 


bn NSA analvst mistakenlv included one e-mail selector 


i1h Sh M > 

authorised by a foreign Intelligence Surveillance Court {FISC ) Order for a For eign 

in a query against E:0. 123 331 


The anal> si estimated the volume of results For the total query at 


tSJ 


messages; however, the analyst did not view any data From| 
question before deleting the query result 
based on the query results. 


selectors in 
There were no reports issued 


in f VI Vi 


an NSA analvst conducting 


query k trued (tol a valid' foreign intelligence taru ct had trawled to the I inted Slates on 


and had departed the country by 


NSA collected 

messages s ent by the target during this time period. The messages were purged 
A heavy workload prevented the analyst from reviewing the selector 


regularly. Management redistributed work to prevent a recurrence of this problem. 


is m rh mu rwm 


to target t 
results on 


ic 


lof alkS.-based 


an NSA analy st inadvertently queried 
[used bv iorej gn targets. The analyst intended 
i he analyst deleted the query 


No reports were issued based on the results of the query. 


(h .hi • m.l, l( ) I V\. I \ I V t 


an NSA analyst inadvertently targeted a 


hvhile pet tormina a uu erv i n a raw traff ic database. Intending to query the 


retrieved communication s of a i .S 
without viewing them on 


3 U.S 


the analyst used query terms that 
The analyst deleted the query and results 


an NSA analyst conduc ted queries on 


the anal • st asked u 


(D//REL TO WflAriFVEV) On_ 

selectors associated with a probable l-.S. person, 
second analyst to look for any other information o n the target that the branch might ha ve. 
"The second NS A analyst Found an e-mail from! 


the queries, the saved results, and data in analy tic files. 


the analvst deleted 


(S.'TT/REL. TO USA. TYEY) 


a new S1G1N T analy st inadvertently 
queried on an e-mail""selector and tv, tg] d mcmimfci g, agiatgd . ithjj L ,S. perso n. 
\i thoug h tiie e-mail address containedj 


khe analyst proceeded with the query tv ui ic ivered 1 o telCftie numbers used 


by the owner of the e-mail address The analyst Failed to verify that the selectors were 
associated with a I’.S. person before performing the query in a raw traffic database. The 
query results were deleted the same day. 


i UP SECR I 1 "TOMINI f N()i CRN 
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.(b)(1) 

(b)(3)-50 USC 3024(i) 
(b)(3)-P.L. 86-36 


iSRU I Q ISA, r Vf.Y ) 


■ Query 

t 


(b)(1) 

(b)(3)-P L. 86-36 


Lin NS A a j t> r discovered a query 
_an NS A analyst peril med LiliLE 


despite available information identifying them as l .S 


No ITS. conimmnicatioi u c c noted and no reports were issued. The query 


and results were deleted on 

Retention 

K RH - 10 t -* A. I \ i V) 


an NSA analyst learned that a foreign intelligence 
target was in the 1 anted States. 1 he same day. the analyst detasked associated selectors arid 
requested that data collected while the target was in the Un ited Stales and stored in a database be 
purged. The collection was not purged until 


because the analyst did not follow 


proper procedures. Management reminded all employ ees of proper procedures to prer ent future 
purging delays. 


(U) Detasking Delays. 


hn NSA analyst discovered that ;t selector tasked 


;(• • ri i. to irsjv. rvnv) 

under E.O. 12333 was not detasked when the taruct visited the United States onl 


j l )pon discovering that the selector 
remained tasked under K.O. 12333 collection, the analyst requested immediate detasking ort | | 


T he collection was deleted on 


K\ ith no reporting. 


tCZ/REL TO USA. TV TV) On an NSA field site was notified that a large volume 

of data was beinu forwarded as nan ol a test of a ravy traffic database. It was determined that 

durine sy stem testing would likely collect 


ITS. communications. Nonna! procedures had not been followed during testing. All local 
tasking was deleted, and the site analyst marked the collection for deletion. No reports, were 
issued based on this collection. . .srbqbxi) 


(b)(3)-P.L. 86-36 


(C//RH1. It) USA. iATYu 


m NSt\ ariah si discovered that & selector for a ! 

' 1 

U.S, person was still tasked 

at a collection site 

. 1 he selector had been detasked on 



put the site failed to implement the detask order. The traffic collected during this time 


period was deleted on 


(G4REL TO USA. PYTYi l 


had neglected to detaskj 
L he se 


an NSA analyst discovered that another NSA anaiyii 


pc 


lectors assoei ted with, targets that were in the 1 : nhed States from 


ectors were detasked on 


Collection on 


f the 


selectors was deleted 


(C7/REL TO USA. FVEY> Qn[ 


there was no reporting. 

I an NSA analyst discovered that a selector had not 


been detasked despiteT" 



the I nit 

i i {)n 

the selector was detasked. 


collection, there was no reporting based on tins collection. 


an. 


analy st deleted the 


(b)(1) 

(b)(3)-50 USC 3024(i) 
(b)(3)-P.L. 86-36 


(b)(1) 

(b)(3)-P.L. 86-36 


■ nr SLCRL NCOM1N LrNOPORK 
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(S'/STflREl.TOUSA. I-'VF - Y) 


(b)(1) 

(b)(3)-50 USC 3024(i) 
(b)(3)-P.L. 86-36 

TOP M.CKI.I • CUMIN i \OE> iRN 

an Nn.v analyst noticed a significant inc rease in 


affected by 


traffic and discovered e-mail m essages from U.S. persons, the collectio n was turned off 

~[ he cause of the error was determined to be 
Ithat was corrected the same dav. A request was made] 


(C//RO. TO USA. TVLVj 


an NSA analyst djseovetfSd thffl 


b purge all data 
[selectors 


(b)(1) 

(b)(3)-P.L. 86-36 


containing typing errors had been tasked in support of two consensual agreements sponsored b>\\ 
an Intellmencc ( ommnnitv ancmv Two .imeoineni-s aiiihori/.i-.l myelino of a IIS person I ] I 


he analyst received a third consensual agreement for the period 


Only when the last agreement was received was the analyst provided with corrected 
. lecto *. At that time the anah st learned that the selectors were used by a! .S. person and had 
been authorized by a consensual agreement. The analyst believes there was no collection fr om I 
the incorrec t selectors. I here has been no reporting. All branch analyst* were reminded on | | 
_[o carefully review approved consensual collection agreements and to take steps to 


avoid typing errors for the selectors. 

(U) Dissemination of U.S. Identities 


( RihSldlKL 1 ISA. i - VI V i The NSA Enterprise issued SJGINT product reports during 

this quarter, in those repo rts, SRiJ NT analysts disseminated communications to. from, or about 
U.S. persons or en tities on | [ occasions while pursuing foreign intelligence tasking this 
quarter. A total of | | SK IINT products were canceled as NSA and Second Party partner anah '-is 
learned of the f .S. persons, organizations, or entities named in products w ithout authorization. 
Ail data in the canceled reports was deleted as: required, and the reports were not reissued or 
were reissued with proper minimization. 


(b)(1) 

(b)(3)-P.L. 86-36 


(U) The Foreign Intelligence Surveillance Act (FISA) 

(U) Database Queries 


"(b)(1) 

(b)(3)-50 USC 3024(i) 
(b)(3)- 3 .L. 86-36 


m yS.\ anah >t performed u query on lhe selectors for \ 


he analyst deleted the .'query and res tills on 
No reports were issued based on the results of the query, ; 


ns si. nia 


an NSA analyst performed a query 


1 ----- - 


The analyst deleted the query and results on 



(U) Tasking Error 



(b)(1) 

(b)(3)-P.L. 86-36 


IBP SEURKIf'/UOMtN l//'NUK)RN 
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TOP SI ( H I I rn\ii\ r N'OFUKN 


(b)(1) 

(b)(3)-50 use 3024(i) 
(b)(3)-P.L. 86-36 



queries to identify collection for deletion. To orevent recurrence of this 

tv pc . u • Ant. NSA 

has implemented a process 



No reports were issued, 

(b)(1) 


!>■ 111 ! iO I ‘-A, |’\TY ) 


|b)(3)-50 USC 3024(i) 

during a review of tasked cellular telephone (b)(3)-p.L. 86-36 


numbers in co njunc tion with preparation for the renewal of the J-TSC Order, NSA analysts 
disetn ered thatr bellular telephone numbers authorized under the Order remained on tasking 






This incident WB& reported to the FlSt; or) 

□ 


;t 3) P.L 85 36 


tb R1 1 1QUSA, rvh¥ i 


NSA discovered that a SIG1N 1 collection site 


c-rmncoitsfy, tasked FAA 704 and 705h sole 


I he she detasked ail oftnc target’s selectors 

i .S in I PA H A Hr 


an NSA-analyst discovered that an e-mail selector 


associated with a FlSC-authorized target remained tasked 

Fhe anah st belie\ ed that all of the target's selectors had been detasked in" 


JJ rattic collected 


l his selector w as detasked on| 
_was purged. 


SI REl. TO USA. 1 VIA ) On 

NSA analysts inadvertently targeted 

telephone selectors 

Inot authorized on NSA FISC Order. The target 

analyst 

The incident occurred because of 


missed communications among several analysts and t he absence of on e of the primary tasking 


wr ■ 

(b)(3)-P,L. 86-36 


analysts. An analyst beaan det askinu the selectors on 
completed on 


and codection from 


The detasking was 


was purged, t me report was issued but was canceled ori 


! he-analyst discovered on 


that, due to a software problem, the re port remained nj the SIGINT report / 
repository. The analyst canceled the report again on 


4 - T u //NPt Business Records (BR) Order 


(b)(1) 

(b)(3)-50 USC 3024(i) 
(b)(3)-P.L. 86-36 


NS A. disco\ered that the BR metadata lor a U.S. telephone id entifier was queried on 



after authorization to target had expired 

The identifier was 

mislabeled as authorized until 

in NSA' 

i li t of identifiers. The incident occurred 


because of delays in NS.V s manual review of the list of identifiers. No reports were issued 

based « n the query results. _NSA implemented a new program to automatically 

update an identifier's authorization status. 


(b)(1) 

(b)(3)-P.L. 86-36 


[UP V . i UlLfoCOMlN VNUl - URN 

7 
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(b)(1) 

(b)(3)-50 USC 3024(i) 
(b)(3)-P.L. 86-36 


(U) The FISA Amendments Act (FAA) %,)(i) 

(bi(3) p I 86-36 

(U) Section 702 

(U) Unauthorized Targeting 

(V hi HI I TO USA. FV 4-¥-r NS A analysts discovered that an e-mail 

selector l oi_a_y_ahd_l \A__702s itho: 1,. J'■ , > s_Un , 'whi le the target wa" in tin I : nited 

States on Although traffic on the target is 

_ l analysts hadovw 'oolvcd ' if >k turn about tht target’st n \ 1 ti du 

United States. The selector w as detasked and collection from 

has been purged. 

O/KRU TO t ESA TVEY>. _ NSA learned that the e-mail address a ssociated \\ \ 

with a valid inteHicence target was tasked while the un-cel uas in the 1. ; niled Stales. I u~ 


the Unite d States, 
1-All FAA 702 data collected! 


las been purgec 


...(iiiimtif-UU: 

(h):i) • 

(b)(3)-PX. 86-36 


I’d I TO I f >. . A t" v E v ) ■ Vs \ an alysts discovered that a t arget tasked 

under FAA 702 authority was in the Umted States between_ Although 

tmi tv : tin u _et, 1 Ithe p rimary analyst wa 1 hi din reviewing 

traffic and tu enooketf hr . mr ' r_ that re v.den ■tbal 

the t Ini ted States: 1 he .selector was detasked on and all collection 

between has been purged. 

(Sm iff i. i O 1 AA . f Vi A ) . . the selector for a valid foreign intelligence target 

rer l aincd .a; „; „ luring the t me .„"targ' i v~ in (he lhut , d St;/, s 1 he : .!ec .jr __s; ocL u J 

vvitlif ■ ...... |the Uniled State s onl I The; 

incid mt < cum 1 F ee tise the aiialy it h^d in idve rtentlv mi.,. .J thi selector . ..L 

The select- r w as detasked oh : at traffic collected dee mg 

was deleted. 


(b)(3)-P.l. 86-36 


(G//REL TO USA, l-'VKY | _NSA discovered that the selector for an. FAA 704- 

authoiized sybject was erroneously tasked [ [The tasking error 

occurred be cause the selecto r was improperly The selector was 

detasked on No collection resulted from the tasking. \ 


iff . RI . L TO U S A. F V t ■ T -r < )nl __NSA disem cred tlvat an analyst had erroneous ly 

tasked a target selector on before the tasking was approved by NSA on 

| [No FAA 702 data w as collected!. 


el licence 


NSA d.i .jvcrc„ drat _selector ; n ‘Kin .cd 

Rite United States 


(b)(1) 

(b)(3)-50 USC 3024(i) 
(b)(3)-18 USC 798 
(b)(3)-P.L. 86-36 


(b)(1) 

(b)(3)-50 USC 3024(i) 
(b)(3)-P.L. 86-36 
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(b)(1) 

(b)(3)-50 USC 3024(i) 
(b)(3)-18 USC 798 
(b)(3)-P.L. 86-36 


_ I Ik incident occurred because the trailic associated with the target selectors was not 

routed to a new analyst when respons ibility for the targ et was transferred__As 

a resul t, traffic was not reviewed alter_| The selectors were detasked on 

and all collection has been purged. 


(N Kb I TO USA., FVCY ) |_during a review of FA A-ta skcd selectors. NS.A : '''ybtm 

analy sts discovered that the s g|egjj r for a valid fa eigh mfeHjgenc&tajrggl I I b )( 3 )-R L. 86-36 

_ the i lilted States from .. ],Vush m s overlooked tins information lli 

___ i ____ Ail collection was deleted on I 

_ IThe'se 'u ctor was not..detasked because the target hud dep, rted the 1 nited States on 


I S Rl.l TO LISA, I \ I V) |_an NSA analyst tasked the selecto r for an individual 

believed to be a valid foreign intelligence fare d _ I the United States. 

While researching the selector and another for_target, the analyst performed a query 

(b)(1) : . Ml a raw traffic database an d found additional nfonriation that suggested that the target may be 

(b)(3)-p.L. 86-36 located in the T nited States^ ! the analyst detasked the selector'and deleted the 

query and results. There was no reporting. (b)(i) 

(b)(3)-50 USC 3024(i) 

_ - r )n- i »r>r?r_ t/-\ t io a _Firr-Tn I f)( 3 )-P L. 86-36 


(U) Database Queries 


(b)(1) 

(b)(3)-50 USC 3024(i) 
(b)(3)-P.L. 86-36 


(S//ST/REL TO USA. PVEY) -On| _Un NSA analyst queried the 

selector for an FA A 705b targe -- jraw traffic database. The queries 

did not prod uce any results or mnnrl mg. t lie--analyst rereive el miming regarding queries on FAA 
705b targets 

U Rl 1 in 1 rSA, FVl Vr an NSA anal>st performed ! Q ueries 

in a raw traffic database on. the selectors associated with an FAA 702 target while he was in the 
United States, i he incident occurred because the analyst did not perform due diligence in 
executing queries that excluded the timeframes of the target's travel to the .United States. ;The 
query and results were deleted the same day the queries were performed. Nq reports were issued 
based on the query results. 

tt • iU IN) USA, FV'UY) During the second quarter. NSA discovered that two software bugs 
prevented the im plem entation ol tasking; and detasking requests. As a result of the. software 
problems, at leas o A A 702 -authorized selectors remained on collection despite attempts to 


(b)(1) 

(b)(3)-P.L. 86-36 
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.1 (b)(i) 

(b)(3)-50 USC 3024(i) 
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detask them. 


and another w 

n s to he - ■ Ted i ecausi 

of the target' 

,s (the United Slates. The 

software problems were disco\ „\red pn 


and ilif[ felectors were manually 


deUisTcTon the same da\ 1 lie software Was modi fired onl 


to correct the problems. 


(S) Rid 1 U 1 S,\, i'\ l Vr On t wo occasions on 
selector for an i ; .AA 705b sub ject 
occurred because the anah sts 


NS A. analysts Queried on a 

t 1 he incidents 


In me instance. *hc an ' t dele Itlu q yj id re I on 


before pe rforming the queries. 
In the second 


u.suncc. the anah s! slopped the query before any results were returned. To pnft nt u .re 
errors, new procedures have been implemented requiring a secondary review before queries are 
submitted. 


I p USA. IM Ab 

mail selectorsT" 


selectors, originally tasked 
accounts were I 


an NSA analyst di scovered that a query on e 

had been detas kedl __ The 

because the 


were detasked on 


]a 1 as. person. The w r >r xcurred because 


another anah si set up queries in a personal folder rather than in a group folder while the 
selectors were still tasked, which prevented other NSA anah sts from being aware of the 
existence of these queries. These querie s were o\ ei looked when the selecto rs were detasked. 
fhe query a nd results collected betweenf 
here was no reporting. 


were deleted on| | 


(U) Detasking Delays 

t 1 s» s[ f> f; io DMA, I - V1Y) During a review of FAA task ed sele ctor 
NSA analysts learned that the e-mail selectors associated with 


(b)(1) 

(b)(3)-P I 36-36 


targets remained tasked after the targets were in the United Stales. 


valid foreign intcllicence 


United States on 
were detasked or 
vvas purged. 


the 


thev ne glected to detask the e-mail selector s. The e-mail selector s 
All FAA 702 data collected between 


AmiTKNi-H 


during a daily review of FAA 702 tasked selectors. NSA analysts 
discovered thatl Motors for a alid foreign targets remained tasked during tire time the targets 
were in the"United Slates. 


the t Tiled States, the targe t analysts err oneously believed that 
selectors we:; " liov ;d fu ... on t.tT , Junue the ti...c did ""|was in the l Tiled States. 


The selectors were n ot detasked becai 
as of 


\11 FAA 702 collection belw 


een 


had departed the United States 


hvas purged. 


(U) Data Handling Errors 


U/ fOUQ -j r Oh ] I occasions bet wee r£ 


: AA-derived 


(b)(1) 

(b)(3)-50 USC 3024(i) 
(b)(3)-P.L. 86-36 


information was available to NSA analysis not cleared for 1 AA access: t hi 
occasions. NSA analysts received e-mails containing FAA 702 information. Upon discovery ‘ 
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the error, the e-mails were fees led i nd deleted. On| ~| ccasions. NSA analysts not cleared for 
access to FAA data were allowed to \ ievv FAA data in a raw traffic database. 


(U) Retention 

(U »rOI. ' t)) .NSA implemt tied anew process to ensure that FISA Amend ments Act l AA) 

collection that is required to be purged is purged from NSA da tabases. A._ 

, to identify daiiiliL.it should be 

purged. During the second quarter, data that matched the selectors on the was purged or 
aged off. 


(U) Section 704 

(U) Database Queries 


(b)(3)-P.L. 86-36 


(( 1 Ul. ()) an analyst queried a raw traffic database using an FAA 

704-approved selector without limiting the search to items collected under FAA 704 
authorization. 1 he analyst realized the mistake before resul ts were returned, so no reports were 
issued. Management counseled the analyst about the importance of performing due diligence 
when conducting FAA-relaled queries. 


(U) Section 705b 

(U) Database Queries 


: •>)(!) 

. (b)(3)-50 USC 3024(i) 
(b)(3)-P.L. 86-36 


(StTO 


NSA discovered that the 1 


_ Based on the disco very of this incident, NSA auditors reviewed other activities and found, 

four more occurrences of _/ 

| In. all instances, the { were deactivated and new ; 
were created to exclude FAA 702 authorized collection. New procedures hat e been \ 

implemen ted that require analysts to indicate_ 

1 in addition, an online working aid prm ides tool-sp ,‘cilic in. iructioa s for qo -n mg 
FAA 705b target selectors. 

( S// REL TO USA. FVEY) | \\ SA 

analysts conducted queries using an ~ util selector knm . to he. { vT i w ith an I A 705b 
target against f AA 702 data, A total of! lqueries were perfomtedl ~ 


1 he problem was corrected on 


Neither the query nor 


the results were stored. 


(b)(1) 

(b)(3)-P.L. 86-36 


(b)(1) 

(b)(3)-50 USC 3024(i) 
(b)(3)-P.L. 86-36 
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(b;(3)-P.L. 86-36 

\ (S//REL TO USA, FYEY) 


TOP anCROV/COMlNTWOrORN 

Ins \ aud itors discovered thal two analysts had 

of a ra w traffic 


queried the selector -assoc iated with an FA A 705b target 
database. A total of| Queries were performed by the two analysts 


While both analysts were aware of the prohibition of targeting I '.S. persons 
|the analysts w ere unaware that, the tarcel. was under FA A 70.5 b a uthority'. Only one o' the 

J i he query did not return 


analv sts was aware 

any results and there was no reporting. New procedures have been implemented that require 
analysts to indicate the location and collection authoritv of the selectors 


an analyst submitted | h omes 


on 


jThe error ; occurred 

targeting 


>f the Selectors returned)] 


(b)(3)-P.L. 86-36 


(S.7REL TO USA. I VFY) On 
selectors for FAA 705b targets 
because the analyst was unaware of I 
FA A 705b-tas ked sel ectors. Queries o h 

and queries ui j [ selectors did not retur n am results. All results were deleted! on_ 

1 he analyst receiv ed additional training oH on the correct query ing procedures and 


L 


data sources when performing queries on FAA 705b-tasked selectors. 

Jan analyst perfor med a query onl 


be 


.•lectors that 


i t • Ri.1 ft) FAA. 1 Vf.Y) _ 

were d eiasked due to the target's tra vel to the f In lied States on^ 
analyst 

neglected to terminate q ueries m a raw traffic database. The analyst deleted the queries and 
results on 


Although the 
the analv st 


No reports were issue based on the query results. 


OWRIX TO USA. 1 ■ V; ■ . V KFn 


while researching a list of tasked selectors, an 


analyst queried the selectors ton_(FAA 705b targets in a raw SIGN! database containing FAA 


702 collection. The error occurred because the analv st did not realize that t he list, contain ed FAA 
705b targ ets before initia ting the queries. The analyst deleted the results orjf Itnd the 

queries on_ 


<v RH TO OS A, FVFjY) _a S1G1N 1 analyst queried the selector used by art 

FAA 705b targe_raw traffic database. While the query was 

running, the analyst did further research that rev ealed that the selector Was associated:with ah 
FAA 705b target. The analyst deleted the query and results. .. 


(U) Tasking Error 


(b)(1) 

(b)(3)-P.L. 86-36 


jJSfAbfWT 


target were erroneously tasked 


\ TO 

TNvV 


:Y discovered that! 


.‘lectors associated with an FAA 705b 


selectors. NSA has since implemented a new tasking rule barring 
when FAA 704 or FAA 705b authorization is applied to the selector 


1 he | 
sites 

□ 

selectors were deleted From 


□ 

xiic 

i not colle ct any traffic on the 
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(U) Other 

(U) Unauthorized Access 
(C' RIiL TO USA. FVKY) 


IOP F 

■ l-( TIL 1 .'rL( ml IN 1 

/vivuiORN— 



7 (b)(3)-P.L. 86-36 


human errors allowed an 


NS A analyst deployed to a held site to access FISA-authorized data although the site is not 
authorize d to access this data. The error was caused h\ a misunderstanding of guidance and a 
delay in suspension of the account after the analyst deployed. 


(S//R.EL TO USA. FVUY) 


four NS A analysts who did not ha\ e the appropriate 


training to view FISA-derived data came in contact with summarized information on the 

l wo analysts 


have already taken the required training and the remaining two analysts have been scheduled to 
take the training. 

(b)(3)-50 USC 3024(i) 

(U) Inappropriate Access Controls on COMSEC Monitoring Data (b)(3)-p 8 L U 86^36 98 


( lv S) KFI , m 1 SA. 1 fdJu 


data had 


NSA discovered that COMSF.C monitoring 


kh.ie.to_ an improperly configured processine system. The configuration 


problems were correcteri-on 


] 


NS A 1 nnh i< nt, J. a 

COMSEC data 


_To prevent future occurrences, 

to alert analysts to the unintended presence of 


(b)(1) 


(b)(3)-p.L. 86-36 ; Unauthorized Collection of COMSEC Monitoring Data 

"fiS.A..discovered that a system problem allowed 


' 7 (b)( 1 ) 

(b)(3)-50 USC 3024(i) 
: (b)(3)-P.L. 86-36 


(SvRJIL FU USA. T VI \ , OrJ 


Jutside of!Jj : auth ’l ized 


provided by the customer. 



Dti U 

ceived 

1_1 

Vom the time of the u : 

wade to the time! [was 

implemented on 


was not 


No reports were issued from the 


(U) Computer Network Exploitation (CNE) 


(b)(3)-50 use. 3024(i) 
(b)(3)-18 USC 793 
(b)(3)-P.L. 86-36 
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(b)(3)-50 USC 3024(i) 
(t>)(3)-18 USC 798 

10P SKCW[7/COMINT//NOrOftN (b)(3)-p.L.86-36 



(U) Nothing to report, 

(U) Intelligence-related Activities 

(fv ' /SloM 1 ) I.o reduce the risk of unauthorized telephony collection and prevent violati ons., NSA 
instituted a process that gives analysts greater and faster insight into a targe’. S lot ttida | | 



In the instances when collection 

oeeurre it u i uiged 1 rout N'; :; V's pii p .1 ra 

w traffic repositories when required. 




1 

NSA lys foundj selectors 



tin, quarter! wi - 5coTTi «, n , ,u. u was purged 


from NSA's principal raw traffic repositories when required. 


(b)(1) 

(bX3)-50 USC 3024(i) 
/ (b)(3)-P.L. 86-36 


(1 i t >>'(.)) Although in>l \ iolations of h,(). 12333 and related directives. NSA/CSS reports 
instances in which database access w as not terminated when access was no longer required: 


(b)(3)-P.L. 86-36 
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(b)(3)-Pl. 86-36 


) op si (, hi i aiomin i \o; orn 


(b)(1) 

(b)(3)-P.L. 86-36 


Quo identified, the accesses were termina ted. In addition. there w crc |~ j inst trices of 
unauthorized access to raw SIGIN i durinaT” 


2. (U) NSA Office of the Inspector General (OIG) Intelligence Oversight (10) 
Inspections, Investigations, and Special Studies 


(l : (/FOLIO) During this quarter, the OIG reviewed various intelligence activities of the 
NSA. CSS to determine whether the) had been conducted in accordance with statutes, executive 
orders. Attorney General procedures, and DoD and internal directives. With few exceptions, the 
problems uncovered were routine and showed that operating elements understand the restrictions 
on NSA CSS activities. 


(U 4F-F-W- 


( U ' /F'OTJO) The 


10 program has undergone several 


(b)(3)-P.L. 86-36 


eadership changes in the past tew 


years and. as a result, is still maturing, fhe site’s program would benefit from continued 
attention to documentation of processes and procedures. ( urrently the site does not have 
Standard Operating Procedu res for in telligence ov ersight. Records to do cument com pliance with 
10 training requirements for_ 


personnel are incomplete: however. 


with the required 10 annual refresher training is good. 


compliance 


(Ul 


(O’RLT. 7 0 BSA. FVE.Y) Purina an OIG review. NSA discovered that thel 


individu als with access to 


to verify whether 

been appropriately trained. liy|_ 

individuals no longer require d ac cess to the data. 
USSID SPOOl 8 training, and 


no formal process 
had 


accounts because the 


had deleted 

(account holders obtained required 


unauthorized access, 
are verified before accounts arc created. 

(U) Misuse of the U.S. SIG1NT System (USSS) 

(U) Nothing to report. 

(U) Congressional and IOB Notifications 


pc couni holders obtained required clearances, To prevent future 
tablished a formal account request process in which clearances 


(b)(1) 

(b)(3)-50 USC 3024(i) 
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(b)(1) 

(b)(3)-P.L. 86-36 


(L') Nothing to report. 


3. (U) Substantive changes to the NSA/CSS Intelligence Oversight Program 


(U) Nothing to report. 


4. (U) Changes to NSA/CSS published directives or policies concerning 
intelligence, counterintelligence, or intelligence-related activities and the reason 
for the changes 


(U) Nothing to report. 
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5. (U) Procedures governing the activities of Department of Defense (DoD) 
intelligence components that affect U.S. persons (DoD Directive 5240.1-R, 
Procedure 15) Inquiries or matters related to Intelligence Oversight Programs 

(l )Nothing to report. 
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